ClawHub
Back to skill

Security audit

ChatbotX MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for ChatbotX administration, but it gives agents broad power to affect live customer messaging and workspace settings, so it belongs in Review.

Install only with a read-only or narrowly scoped ChatbotX token unless you intentionally want agent-driven writes. Avoid running this against production until you have human approval gates for sends, broadcasts, publishes, deletes, member changes, integrations, and webhook changes. Prefer a pinned or pre-reviewed `chatbotx-mcp` package version instead of unpinned `npx` execution.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill exposes broad operational capabilities over a live customer messaging workspace, including writes, broadcasts, sequence changes, and access to destructive operations, but the safety caveats are not prominent at the start of the skill. This increases the chance that an operator or agent will treat the integration as routine automation and trigger impactful actions against real customer data or production state.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill instructs users to launch the MCP server via `npx -y chatbotx-mcp` without pinning a specific version. That causes execution of whatever package version is current at install time, creating a supply-chain risk where a malicious or compromised upstream release could gain access to high-privilege ChatbotX API credentials and perform workspace actions.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
| Tool | Description |
|---|---|
| `search_tools` | Search the full API for a tool outside the default set. Returns name, description, and input schema. |
| `call_tool` | Execute any tool by name, including tools found by `search_tools`. |

Current default categories:
Confidence
91% confidence
Finding
The documented `search_tools` plus `call_tool` pattern enables execution of any tool exposed by the backing API, including destructive or sensitive operations beyond the curated default set. Even if server-side authorization exists, this significantly expands the agent's action surface and can facilitate misuse, accidental destructive changes, or prompt-driven invocation of dangerous endpoints when a sufficiently privileged token is present.

Static analysis

No suspicious patterns detected.